Mwobensmith

The issue exists due to the browser's failure to properly enforce web page structure protection, allowing a remote attacker to conduct cross-site scripting (XSS) attacks using a specially crafted applet. This can be achieved by ignoring Content Security Policy (CSP) directives for cross-domain Java applets.

The issue concerns the getUserMedia permission implementation, which incorrectly references the URL of a top-level document instead of the URL of a specific page. This makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME elements.

A use-after-free issue in the `nsContentUtils::RemoveScriptBlocker` function allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption via unspecified vectors.